High severity7.3NVD Advisory· Published Aug 31, 2026

CVE-2026-82607

Description

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Profile Builderllm-fuzzy
Range: <=3.16.1
Package: https://wordpress.org/plugins/profile-builder
Cozmoslabs/Profile Builderllm-fuzzy
Range: <=3.16.1

Patches

Vulnerability mechanics

References

ciphersecuritylabs.com/research/articles/when-the-browser-is-the-only-bouncer-unauthenticated-media-upload-in-profile-buildernvd
vuldb.com/cve/CVE-2026-82607nvd
vuldb.com/submit/892841nvd
vuldb.com/vuln/397108nvd
vuldb.com/vuln/397108/ctinvd
www.cozmoslabs.com/docs/profile-builder/free-changelog/nvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000